ZWYJ
中文

Use Cases

Wherever fraud reaches, adjudication follows

Five reach scenarios plus three capability outputs, covering the chain from luring to money flow. Every scenario ships an interactive workflow diagram and a simulated demo — demos are driven by real component state, with data provenance labeled per item.

LuringReal batch run

IM black/gray-market intelligence

Turn 58,000 groups into searchable leads

The group name is the signboard; the messages are the evidence. Rules extract entities, the model judges context, and one batch run produces a full group profile: domain distribution, fraud probabilities, deposit systems, and disposition priority.

  • Corpora of 6.6M Chinese group names and 350M in-group messages
  • 58,133 groups adjudicated in full, 69.2 minutes end to end
  • 30,047 black/gray groups, 25,319 at confidence ≥ 0.9
  • 11 IOC entity types, de-identified by default on output

Fraud intelligence analysis workflow

Play simulates a full batch run: steps advance with progress and counters grow live.

0Groups processed
0.0min · Elapsed
14groups/s
01

Import

Groups: 58,133

Ingest IM group exports — group names and in-group messages, organized per group.

Group intelligence console

Press “Run batch” to watch the matrix adjudicate cell by cell; click the matrix or group list to switch the judgment card.

Group intelligence consoleInteractive demo
Group adjudication matrix (demo sample)
<0.3 normal0.3–0.50.5–0.9≥0.9 high conf.
Group judgment card
0.97Fraud probability
Public-605 · deposit 2000U · cigarettes direct ship
DomainCounterfeit goods
PriorityHigh
Hit signals
numbered public group + depositcounterfeit brand wordnationwide direct ship
Suggested actionAdd to black/gray list
Money channel11,640
Accounts & cards4,446
Gambling4,227
Illegal adult2,602
Traffic recruit2,334
Privacy lookup1,003
Underground tech737
Suspicious system648
58,133Groups30,047Black/gray25,319High conf ≥0.969.2 minDuration118.5msAvg latency
Data provenance

58,133 groups / 30,047 black/gray / 25,319 high-confidence are real batch-run results; the console matrix and judgment cards are an interactive demo illustrating the judgment logic — not a production interface.

ReachPilot validation

SMS anti-fraud gateway

The message still arrives — the alert arrives with it

No “block on sight”. Signal first, then content, then user — three decision layers, four dispositions; the 12381/96110 official alert whitelist passes directly with zero disturbance.

  • 46,200 messages/day inspection pool (demo environment)
  • 82ms from judgment to alert
  • 1,483 active ports; 46 high-risk ports drive 89% of fraud volume
  • Zero false alerts on 12381 / 96110 / National Anti-Fraud Center messages

SMS fraud risk analysis workflow

Play to watch messages flow through the three-layer funnel: the official whitelist bypasses directly; the rest converge to four dispositions.

Incoming messages
Four dispositions0Blocked0User alert0Manual review0Passed
L1

L1 Signal layer · Number / signature / template / link / frequency

Signal before content: port reputation, signature registration, template consistency, link domain age, send frequency. The signal layer stops obvious anomalies; the official alert whitelist passes here.

Port reputationSignature matchTemplate registrationLink domain ageFrequency anomaly

SMS adjudication console

Switch demo cases to see how the nine parallel judgments and fusion gate differ.

Interactive demo
106907431209:41

[XX Protection] Your million-yuan protection has expired. It will auto-charge ¥2,000/month unless cancelled today. Visit xx-protect-close.com to cancel now, or contact our agent.

Extracted linkxx-protect-close.com
⚠ Block + recipient alert

Sending port: 1069074312

Nine questions in parallel
Main judgment0.97
Asks to click0.96
Asks to transfer0.71
Asks for credentials0.62
Impersonation0.93
Urgency0.88
Fraud typePlatform impersonation · phantom fee
Fusion gate
final = max(main, 0.9×click, 0.85×impersonation)
Disposition⛔ Block + recipient alert0.97
Hit signals
Forged signatureFresh domain (2 days)Asks to clickInduces adding an “agent”Manufactured urgency

Judgment latency (demo): 82ms

Data provenance

SMS gateway figures are demo-environment scope: 46,200 messages/day, 82ms judgment-to-alert, zero false alerts on official numbers. The judgment logic is a rule-driven demo flow — results do not represent real model inference.

ManipulationPilot validation

On-device real-time alert

Interrupt the scam before the transfer

Call content never leaves the device: an on-device model judges line by line, and alerts fire the moment risk crosses the threshold. Training assets: 28,511 voice-text pairs, 307 hours of audio, 12,406 elder-fraud dialogs.

  • On-device <50ms per-line inference (demo metric), no network needed
  • Content never leaves the device; only risk conclusions are emitted
  • Elder protection: trained on elder-fraud script dialogs
  • Behavior signals: screen sharing, call silence, payment app launch

Device risk alert workflow

Play to watch risk stages evolve; step manually to inspect each stage’s signals and risk climb.

Device · Content stays on device
Cumulative risk0Alert threshold 70

Line-by-line call adjudication

Play the call demo: lines appear with per-line risk; cumulative risk crossing 70 triggers the alert.

Interactive demo
In call00:00
Call risk0Alert threshold 70

Play →

Each line is judged independently; cumulative risk crossing the threshold triggers an instant alert.

  • On-device form: per-line inference runs locally; content never leaves the device.
  • Demo dialogs are synthetic samples rewritten from real scam-script structures.
Data provenance

28,511 voice-text pairs, 307 hours of audio, and 12,406 elder-fraud dialogs are training data assets; on-device <50ms is a demo metric. Call demos are synthetic samples.

Reach / manipulationTraining in progress

Web & app fraud analysis

An evidence chain from page to infrastructure

A website is not a page — it is an evidence network of domain, certificate, IP, ASN, template, screenshot, and code; the app is the black market’s main delivery form, traced to its command domains through static and dynamic analysis.

  • Web detection: 425 HTML files + screenshots, 196 human-reviewed tasks, 14-class labels (training in progress)
  • App analysis: 25 public entry classes crawled hourly; Redroid 24-slot dynamic behavior capture
  • Evidence output: conclusion report + forensic detail report + command domains / IPs

Web / app analysis workflow

Switch between web and app targets; press “Run analysis” to watch the evidence network light up and the verdict form.

  1. Extract
  2. Feature assembly
  3. Model judgment
  4. Evidence summary
Targetxx-protect-close.com

Evidence details

Click any evidence node for details

Data provenance

Web detection model training is in progress: 425 HTML/screenshot files, 196 human-reviewed tasks, 14-class labels — no production accuracy claimed. App dynamic analysis runs on Redroid + AutoGLM sandboxes. Evidence values in the demo are de-identified examples.

Transfer / launderingPlanned

Money-flow anti-fraud

From the QR code to the smurfing network

The last mile of fraud is money. Linking collection cards, QR codes, wallet addresses, and smurfing fleets into a graph is what blocks the transfer. For banks and payment institutions: fraud accounts, QR codes, and fund-path detection with evidence packs.

  • Fund entities: collection/payer cards, collection QR codes, wallets, bank accounts
  • QR decode & normalization: screenshot → OCR → decode → account normalization → association
  • Smurfing patterns: rotating QR codes, many-small-transfers, card pools, burst triggers

Fund path illustration

Victim → collection QR → tier-1 card → tier-2 card → smurfing fleet → cash-out: every hop leaves traceable entities in the graph.

VictimCollection QRTier-1 cardTier-2 cardSmurfing fleetCash-out
Data provenance

Money-flow anti-fraud is a planned scenario: bank/payment customers in progress, capability under construction. This section describes the target design, not a delivered system.

Capability outputPlanned

Intelligence API

Adjudication as a callable risk score

Not every customer needs a full system. Risk scores for domains, IPs, apps, cards, and phone numbers as an API is the lightest form of integration — for cloud, enterprise security, and bank risk teams.

  • Risk scores for domains / IPs / apps / cards / phone numbers
  • Unified JSON output: score, type, signals, action
  • Usage-based billing; first capabilities ready

API example

Request
POST /v1/risk/domain
{ "domain": "xx-protect-close.com" }
Response
{
  "score": 0.97,
  "type": "impersonation_platform",
  "signals": ["domain_age_2d", "no_icp", "blacklist", "asks_user_click"],
  "action": "block"
}
Data provenance

The intelligence API is a planned capability; the interface example is a design draft, not a live service.

ForensicsPlanned

Analyst Copilot

Every conclusion traces back to evidence

Combine the entity graph, evidence chains, and natural-language query with an LLM — the analyst shifts from digging through data to asking questions. Output: conclusion + evidence chain + confidence, exportable as a forensic pack.

  • GraphRAG: entities, relations, and evidence as retrieval objects
  • Natural language → structured queries
  • Exportable forensic packs for anti-fraud centers and research teams
Data provenance

The analyst Copilot is a planned product direction; parts of the underlying capability (entity graph, NL-to-query) exist, the overall product is under construction.

Base capabilityPilot validation

Cross-language intelligence

One question set, reused across languages

JianCe covers 201 languages and dialects of base language capability — cross-language scripts and cross-border fraud content can enter the same unified judgment pipeline with the same structured question set; performance in specific languages is bound by the training and validation scope.

Cross-language adjudication demo

Switch input languages to watch fraud content in different languages enter one pipeline and produce one structured result.

Interactive demo
Intelligence input
社保专线Language: 中文

【社会保障局】您的社保账户已停用，今日内登录 ssb-verify.com 补录信息，否则将冻结账户。

  1. 1Language ID
  2. 2Unified judgment
  3. 3Structured output
0.93Fraud probability
Script typeImpersonation · account-suspension script
Hit signals
Forged institutionFresh domainManufactured urgency
Language capability scope
Language capability: the model base covers 201 languages and dialects (Qwen3.5 architecture), providing the foundation for cross-language adjudication.
Our model: the JianCe decision model is trained and fine-tuned on Chinese corpora; performance in specific languages is bound by training and validation scope — no equivalent-performance claims on unverified languages.
Data provenance

201 languages is the official claim of the base (Qwen3.5 architecture); scores in the demo are rule-driven example outputs, not real model inference.